CVE-2024-5859: Vcita WordPress Plugin XSS Vulnerability

CVE-2024-5859 Overview

CVE-2024-5859 is a reflected cross-site scripting (XSS) vulnerability in the Online Booking & Scheduling Calendar for WordPress by vcita. The flaw affects all plugin versions up to and including 4.4.2. The plugin fails to sanitize input and escape output for the d parameter, allowing unauthenticated attackers to inject arbitrary JavaScript. Exploitation requires a victim to click a crafted link, after which the injected script executes in the victim's browser session. The weakness is tracked as CWE-79.

Critical Impact
Unauthenticated attackers can execute arbitrary scripts in a victim's browser, enabling session theft, account takeover, or redirection to attacker-controlled infrastructure when a victim clicks a crafted link.

Affected Products

vcita Online Booking & Scheduling Calendar for WordPress — all versions through 4.4.2
WordPress sites running the meeting-scheduler-by-vcita plugin
Any WordPress deployment exposing the vulnerable d parameter to unauthenticated users

Discovery Timeline

2024-06-21 - CVE-2024-5859 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-5859

Vulnerability Analysis

The vulnerability is a reflected XSS flaw in the vcita Online Booking & Scheduling Calendar plugin. The d request parameter is reflected into HTML output without sufficient sanitization or escaping. An attacker crafts a URL containing malicious JavaScript in the d parameter and delivers it through phishing, social media, or embedded links. When a victim clicks the link, the server reflects the payload into the response and the browser executes it in the context of the WordPress site.

Because the attack requires no authentication, any visitor who can be convinced to click a link becomes a potential victim. The CVSS scope is marked as changed, reflecting the ability of injected scripts to affect resources outside the vulnerable component, such as the authenticated session of a logged-in administrator viewing the crafted URL.

Root Cause

The plugin reads the d HTTP parameter and emits it into rendered HTML without applying WordPress escaping functions such as esc_html(), esc_attr(), or sanitize_text_field(). This missing output encoding allows attacker-controlled markup and script tags to be interpreted by the browser rather than treated as inert text.

Attack Vector

Exploitation is network-based and requires user interaction. The attacker constructs a URL pointing at a vulnerable WordPress site with a JavaScript payload placed in the d query parameter. The payload executes under the origin of the targeted site, giving the attacker access to cookies, local storage, and the DOM. If an administrator triggers the link, the attacker can perform privileged actions through the victim's session.

No verified public proof-of-concept code is available. See the Wordfence Vulnerability Intelligence entry and the WordPress Plugin Changeset for the remediation diff.

Detection Methods for CVE-2024-5859

Indicators of Compromise

Web server access logs showing requests containing d= parameter values with HTML tags, script, onerror, onload, or URL-encoded equivalents such as %3Cscript%3E.
Referrer headers originating from external domains pointing at plugin endpoints under meeting-scheduler-by-vcita.
WordPress administrator sessions performing unexpected actions shortly after visiting an external link.

Detection Strategies

Deploy a web application firewall (WAF) rule to flag requests to vcita plugin endpoints where the d parameter contains script-like syntax.
Hunt in HTTP logs for reflected XSS patterns by matching request parameters against response bodies for unescaped user input.
Monitor browser-side Content Security Policy (CSP) violation reports for inline script execution originating from the plugin's URLs.

Monitoring Recommendations

Alert on any outbound requests from administrator browsers to unfamiliar domains immediately after loading pages served by the vulnerable plugin.
Track WordPress audit logs for privileged configuration changes correlated with administrator sessions that visited crafted URLs.
Review installed plugin inventory regularly and compare running versions against the fixed release.

How to Mitigate CVE-2024-5859

Immediate Actions Required

Update the Online Booking & Scheduling Calendar plugin to a version later than 4.4.2 that includes the patch referenced in the WordPress plugin changeset.
Deactivate and remove the plugin on sites that cannot be updated promptly.
Instruct administrators to avoid clicking unsolicited links referencing site URLs with unusual query parameters.

Patch Information

The vendor committed a fix in the meeting-scheduler-by-vcita repository tracked at WordPress Plugin Changeset 3104980. Site operators should install the latest version from the official WordPress plugin directory and verify the version string after update.

Workarounds

Apply a WAF signature that blocks requests to plugin endpoints when the d parameter contains <, >, script, or javascript: tokens.
Enforce a strict Content Security Policy that disallows inline scripts to reduce the impact of reflected payloads.
Restrict administrator access to the WordPress dashboard from trusted networks only, limiting the audience exposed to crafted links.

bash

# Example ModSecurity rule to block script-like payloads in the vulnerable parameter
SecRule ARGS:d "@rx (?i)(<script|javascript:|onerror=|onload=)" \
    "id:1005859,phase:2,deny,status:403,log,msg:'CVE-2024-5859 vcita XSS attempt blocked'"